Peer to peer SVC-based DSL service

BACKGROUND OF THE INVENTION

p-00021. Field of the Invention

p-0003The present invention relates to the field of telecommunications. More particularly, the present invention relates to dynamically establishing broadband QoS (Quality of Service) connections, on demand, between peers on a network to guarantee application specific IP QoS via the combination of ATM switched virtual connections (SVCs) and permanent virtual connection (PVCs).

p-00042. Background Information

p-0005Network carriers are currently providing broadband access services to a large number of subscribers using asynchronous transfer mode (ATM) and digital subscriber lines (DSL). Under the current paradigm, subscribers connect to an Internet service provider (ISP) using a pre-existing static point-to-point or “nailed up” connection, e.g., a permanent virtual circuit (PVC). Once the connection has been established the subscriber can communicate to the ISP, via the connection, using various bridge or router modes. In the case of bridge mode, typically point-to-point protocol (PPP) or point-to-point protocol over Ethernet (PPPoE) is used to set up the user sessions and carry the user IP packets to the ISP. When a subscriber wishes to communicate with a peer subscriber, all communications via IP packets travel through the ISP, thus suffering implementation complexity and operational unfeasibility for supporting application specific QoS.

p-0006It would be desirable to have a system that permits a subscriber to connect to a peer subscriber via a guaranteed quality of service (QoS) connection, across the ATM network, while bypassing the ISP.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0007The present invention is further described in the detailed description that follows, by reference to the noted drawings by way of non-limiting examples of embodiments of the present invention, in which like reference numerals represent similar parts throughout several views of the drawings, and in which:

p-0008<figref idrefs="DRAWINGS">FIG. 1</figref> is a block diagram showing an exemplary network architecture, according to an aspect of the present invention;

p-0009<figref idrefs="DRAWINGS">FIG. 2</figref> is a block diagram illustrating an exemplary relationship between logical components, according to an aspect of the present invention; and

p-0010<figref idrefs="DRAWINGS">FIG. 3</figref> is a block diagram showing an exemplary network architecture, according to another embodiment of the present invention.

DETAILED DESCRIPTION OF EMBODIMENTS

p-0011The present invention relates to dynamically establishing a shortcut connection to a peer device that a subscriber has selected, without going through an ISP.

p-0012In view of the above, the present invention through one or more of its various aspects and/or embodiments is presented to accomplish one or more objectives and advantages, such as those noted below.

p-0013According to an aspect of the present invention, a method is provided for dynamically establishing a peer to peer connection from a source subscriber to a destination subscriber. The method includes receiving at a connection server, a connection request via a control connection, the connection request requesting establishment of a QoS connection(s) to the destination subscriber. The method also includes forwarding the connection request to a proxy signaling agent; and signaling from the proxy signaling agent to a source switch, which the source subscriber connects to through a DSLAM to dynamically establish QoS connections to a destination switch, which the destination subscriber connects to through a DSLAM.

p-0014In one embodiment, the QoS connection is a switched virtual circuit (SVC). The request may include the destination subscriber, a class of service of the SVC and a traffic descriptor of the SVC.

p-0015The method may also include querying a database for information about the source subscriber, the destination subscriber and a network; and forwarding the information to the proxy signaling agent to enable the proxy signaling agent to establish the QoS connections.

p-0016The method may further include establishing the QoS connections, updating at least one routing table to reflect each QoS connection; and routing traffic in accordance with the updated routing tables so that application packets associated with the QoS connections are routed over the QoS connections and all other packets are routed over other connection(s). At least one routing table may be a routing table stored in the source subscriber PC and also a mapping table stored in an ADSL ATU-R.

p-0017In one embodiment, the method also includes tearing down the QoS connections; updating the routing tables to reflect that the QoS connections no longer exist; and routing traffic in accordance with the updated routing tables so that all traffic is routed over the other connection to the ISP.

p-0018The method may also include receiving a header pattern at the subscriber ATU, receiving application data from the subscriber client at the subscriber ATU-R, and determining whether to forward the received application packets over the dynamically established QoS connections based on whether the application packets match the header pattern. When the received application packets match the header pattern, the method includes forwarding the received application data over the QoS connections. When the received application packet is determined not to match the header pattern, the method includes forwarding the received application packet over another connection. The header pattern may include layer 3 and layer 4 information and the determination may include analyzing the layer 3 header and the layer 4 header of the received application packet to determine if the received application packet matches the header pattern.

p-0019The various aspects and embodiments of the present invention are described in detail below.

p-0020<figref idrefs="DRAWINGS">FIG. 1</figref> is a block diagram depicting an exemplary network infrastructure in which the present invention operates. A subscriber's computer <b>10</b> is connected to a DSL ATU-R <b>12</b> at the subscriber's premises. Although the subscriber's computer is referred to as a PC in the following description, the computer is not limited to a personal computer. Rather the subscriber's computer (also referred to as a client) can be any device capable of communicating to an ISP.

p-0021An exemplary DSL ATU-R is the SpeedStream 5360 DSL Model, available from Efficient Networks, Inc. of Dallas Tex. The DSL ATU-R <b>12</b> connects to a digital subscriber line access multiplexer (DSLAM) <b>14</b> using a pre-existing digital subscriber line. The DSLAM <b>14</b> is connected to a high speed network, e.g., an ATM network <b>16</b>. The DSLAM <b>14</b> connects to an ATM edge switch <b>15</b>, which operates as a gateway into the ATM network <b>16</b>. Although the following description refers only to ATM, any connection-oriented network that supports equivalent QoS can be substituted for the ATM network <b>16</b>.

p-0022The ATM network <b>16</b> includes a number of ATM switches <b>15</b>, <b>17</b>, <b>19</b>. Exemplary switches include the Alcatel 7670 Routing Switch Platform, available from Compagnie Financière Alcatel of Paris, France. An exemplary DSLAM <b>14</b> is the Alcatel 7300 Advanced Services Access Manager, available from Compagnie Financière Alcatel of Paris, France.

p-0023An edge ATM switch <b>17</b> of the ATM network <b>16</b> connects via the Internet <b>20</b> to a service provider's broadband remote access server (B-RAS) <b>22</b>. The B-RAS <b>22</b> terminates PPP connections for each DSL subscriber <b>10</b>. An exemplary B-RAS <b>20</b> is an SMS 1800, available from Redback Networks Inc. of San Jose, Calif. The B-RAS <b>22</b> connects to the Internet service provider <b>24</b>. The connection to the Internet service provider <b>24</b> is via a local connection, such as an Ethernet connection.

p-0024Typically the connection from the subscriber <b>10</b> to the B-RAS <b>22</b> is pre-provisioned and it will be referred to as a signaling connection or a control connection. In one embodiment, the control connection is a manually configured permanent virtual connection (PVC) though which a PPP session is established.

p-0025According to an aspect of the present invention, the subscriber <b>10</b> can dynamically select a peer device <b>40</b> to communicate with and can request QoS connections to the peer device by communicating over the control connection. In one embodiment, the QoS connection to the peer device <b>40</b> is a dynamically established SVC <b>50</b>. Although the description refers to an SVC as the QoS connection, it is noted that an SVC is merely a non-limiting example of a QoS connection; and another type of QoS connection, such as Soft Permanent Virtual Circuit (SPVC), can be used instead of an SVC without departing from the scope and spirit of the present invention. An example of when a subscriber <b>10</b> might desire such a QoS connection is when the subscriber <b>10</b> desires to engage in a video conference with another subscriber <b>40</b>.

p-0026In order to dynamically establish the SVC <b>50</b>, the subscriber <b>10</b> transmits a connection setup request to the connection server <b>25</b>. In the following description, subscriber refers to the combination of the client and an associated network service agent. The client communicates to the connection server <b>25</b> via an API to a software component, the network service agent, which is located on the client (bridge model) or ATU-R (routed model).The request, originating from the subscriber <b>10</b> is transmitted to the connection server <b>25</b> over the subscriber's best effort connection to the ISP. The request includes information about the SVC <b>50</b> (or SVCs, each being associated with a different application) to be setup, including the destination subscriber <b>40</b>, a shared session key agreed upon by subscriber <b>10</b> and subscriber <b>40</b>, a class of service of the SVC <b>50</b>, and a traffic descriptor of the SVC <b>50</b>. The class of service can be, for example, constant bit rate (CBR) or variable bit rate (VBR). The traffic descriptor describes the requested bandwidth in terms of ATM standard traffic descriptors, e.g., by sustained cell rate (SCR), peak cell rate (PCR), and maximum burst size (MBS).

p-0027The connection server <b>25</b> then queries an LDAP <b>30</b> for information about the subscriber <b>10</b> and the subscriber <b>40</b>. The LDAP <b>30</b> receives such subscriber information, and information about the network as part of the provisioning process flow. Exemplary subscriber and network information includes the following information for both subscriber <b>10</b>/switch <b>15</b> and subscriber <b>40</b>/switch <b>19</b>, the switch identifier (possibly an IP address or switch specific proprietary address), the physical port number , the logical port number , end system addresses (e.g., ATM AESA address) of source and destination UNIs; a set of VPI/VCIs at the source UNI and a set of VPI/VCIs at the destination UNI; and an address (e.g., an IP address) of a proxy signaling agent (PSA) <b>35</b>. The LDAP <b>30</b> also stores some other network related information, such as up-link port speeds and DSL synchronization rates\needed for the connection server to calculate total available bandwidths and perform the CAC function for ATU-R and DSLAM ports.

p-0028Authorization and authentication information can also be retrieved from a RADIUS server <b>28</b>, if necessary. In addition, accounting records can be stored on the RADIUS server <b>28</b>. The RADIUS server <b>28</b> is provisioned with the user authentication information (username and password) as part of the customer management flow.

p-0029In one embodiment, the destination subscriber <b>40</b> must also perform the previously described actions by requesting a connection to the source subscriber <b>10</b> with identical parameters after the subscriber <b>40</b> receives the application session setup message from subscribe <b>10</b> through the best effort connection. By receiving connection requests from both subscribers <b>10</b>, <b>40</b> within a time-out period, the connection server <b>25</b> considers the connection request to be both originated and accepted by both subscribers <b>10</b>, <b>40</b>.

p-0030After the necessary information, such as the ATM AESA addresses, VPI/VCIs, class of service, and bandwidth, etc., is obtained from the LDAP <b>30</b> and the RADIUS server <b>28</b>, the connection server <b>25</b> performs a call admission control (CAC) step to determine if sufficient available bandwidth exists in the ATU-Rs and DSLAMs to accommodate the connection request. The connection server <b>25</b> maintains state information of the currently available bandwidth at each subscriber's ATU-R and related DSLAM up-links. If sufficient bandwidth is available, then the connection server <b>25</b> sends the SVC request and the necessary information to a proxy signaling agent <b>35</b>. The proxy signaling agent <b>35</b> is responsible for performing the SVC signaling and relaying results and status information from the network elements to the connection server <b>25</b>. That is, the proxy signaling server <b>35</b> communicates with the SVC capable ATM network <b>16</b> to establish, to tear down, and to obtain the status of SVC connections, and to obtain information about resource availability.

p-0031After receiving the necessary information, the proxy signaling agent <b>35</b> communicates with the requesting subscriber's edge switch <b>15</b> to initiate an SVC <b>50</b> to the destination subscriber's edge switch <b>19</b>. The proxy signaling agent <b>35</b> informs the edge switch <b>15</b> of the destination switch address and then the SVC <b>50</b> is set up in the standard manner.

p-0032Once the SVC <b>50</b> is set up, proxy signaling agent <b>35</b> informs the connection server <b>25</b>, then connection server <b>25</b> sends a message to both subscribers, specifically the network service agent associated with each client, informing them of the successful connection establishment. Then the routing tables are updated in both subscribers' PCs (for bridge mode) or ATU-Rs (for router mode) so that QoS application packets can be sent over the new QoS connection. In the bridge mode, a packet mapping table is also modified in the ATU-R. As is well known, every PC has a routing table to provide the routing information when multiple IP interfaces are available for outbound IP traffic. Routing entries in the routing table typically follow the syntax of <destination IP network address, network mask, gateway IP address, interface IP address, metric>. The operating system routing function will forward a packet according to the longest matched routing entries in the routing table based on the destination address in the packet.

p-0033According to the present invention, the location of the routing tables varies. In a bridge mode, the routing table is stored on the source subscriber's computer <b>10</b> . In a routing mode, the routing tables are stored on the subscriber's ATU-R <b>12</b>.

p-0034Regardless of where the routing table is stored, traffic packets are transmitted from the source subscriber <b>10</b> over either the new QoS connection or the default route to the ISP, based upon whether or not the packet originates from an application associated with the new QoS connection. For example, if the application requesting the SVC <b>50</b> is a video conferencing application and the packets being transmitted originate from the video conferencing application, then the video conferencing packets are transmitted over SVC <b>50</b>. In other words, the packets travel from the subscriber <b>10</b>, through the PVC from ATU-R <b>12</b> to the DSLAM <b>14</b>, the SVC <b>50</b> from the ATM switch <b>15</b> to the ATM switch <b>19</b>, and the PVC from the DSLAM <b>44</b> to the ATU-R <b>44</b> and finally to the destination subscriber <b>40</b>. If the packet originates from other applications than the QoS application, the packets are transmitted, as usual, via the default route (or routes) to the ISP <b>24</b> and then on to its intended destinations.

p-0035Routing packets based upon the originating application will be referred to as policy based routing or filtering. Policy based routing ensures quality of service for specific end user applications. According to an aspect of the present invention, the policy based routing capability is dynamic. That is, the policy based routing only occurs during a session, e.g., during a video call. When the session terminates, the ATU-R <b>12</b> receives a signal indicating the session termination and the pattern matching and filtering cease. Accordingly, all traffic is routed over the normal channel.

p-0036Policy based routing thus occurs when an SVC <b>50</b> has been set up. For router mode, after the setup, the PC <b>10</b> sends a header pattern to the ATU-R <b>12</b> so that the ATU-R <b>12</b> knows to filter traffic matching the received pattern. In other words, the ATU-R <b>12</b> knows to send the traffic matching the header pattern to the new QoS connection. When a packet does not match the header pattern, the packet is sent along its normal route.

p-0037Current routing tables have routing entries associated with a destination network address. The current entries are typically too coarse to distinguish between the specific applications for the purpose of mapping into a specific route. According to the present invention, a new gateway (i.e., the QoS connection/the SVC) exists to handle special traffic (e.g., video conference traffic). Policy routing is a function to filter the video conference traffic and direct such traffic to a separate gateway different from that default gateway in the existing routing table.

p-0038In one embodiment, the syntax of the policy routing instruction is: <source IP network address, source network mask, destination IP network address, destination network mask, IP protocol ID, type of service (TOS), source port number, destination port number, gateway IP address, interface IP address, metric>. The IP protocol ID parameter defines the layer 4 protocol. The type of service parameter refers to a field in the IP header to carry information on traffic packet priority, e.g., best effort, highest priority, etc. The gateway IP address refers to the next hop. The interface IP address refers to the egress port. The metric defines an administrator assigned weight, the weight being assigned to different routes, e.g., hop count.

p-0039An example will now be provided. Assume the routing policy is as follows 64.2.12.3 255.255.255.0 217.34.67.122 255.255.255.255 17 8 6000 6000 66.2.12.1 64.2.12.3 1. Then, all packets having the value matching this specific policy will be directed to gateway 66.2.12.1 via 64.2.12.3, which is a local interface IP address.

p-0040Referring to <figref idrefs="DRAWINGS">FIG. 3</figref>, another embodiment is described in which multiple proxy signaling servers <b>35</b>, <b>36</b> are provided. In this embodiment, the source subscriber <b>10</b> and the destination subscriber <b>40</b> may be assigned to different proxy signaling agents <b>35</b>, <b>36</b> at the LDAP <b>30</b>. In such a case, the setup process is slightly different. If both subscribers <b>10</b>, <b>40</b> are located within the same ATM domain, the connection must choose which side to originate the SVC connection and to contact the originator's proxy signaling agent <b>35</b> to set up the connection. If the subscribers <b>10</b>, <b>40</b> are located in different ATM domains (as shown in <figref idrefs="DRAWINGS">FIG. 3</figref>), e.g., different vendor domains owned by a single carrier, the connection server <b>25</b> establishes two connection segments, one originating at each subscriber, to a common network to network interface (NNI) meeting point. The connection server <b>25</b> can retrieve available NNI information from the LDAP <b>30</b> to handle these types of connections. The connection server <b>25</b> can also track real time state information about NNI usage.

p-0041As discussed above, a router mode and a bridge mode are available. In the router mode, the ATU-R <b>12</b> functions like a traditional router. That is, the ATU-R <b>12</b> examines the layer 3 and layer 4 information and routes packets based upon such information. Accordingly, the ATU-R <b>12</b> routes at the application level. In this embodiment, the routing table resides at the ATU-R <b>12</b>. Moreover, it is well known that in the router mode the PPPoE session from subscriber to ISP originates on the ATU-R <b>12</b>.

p-0042In the bridge mode, the ATU-R <b>12</b> functions like an Ethernet bridge with additional packet mapping capabilities. Ethernet bridges without additional mapping capabilities have no IP awareness and can only perform switching at a host level of granularity. The switching is based on MAC addresses, which are unique per client. In this embodiment, the routing table resides at the client <b>10</b> and the client <b>10</b> performs the routing. In addition, a packet mapping filter at the ATU-R switches the packets into different outgoing PVCs based on mapping rules associated with each QoS session. These rules consider layer three and layer four header information in a manner similar to the described policy routing method.

p-0043In the bridge model, a client DSL dialer application establishes a standard, best effort PPPoE session between the client PC <b>10</b> and the ISP B-RAS <b>22</b>. The ISP <b>24</b> provides the client <b>10</b> with a public IP address, which is globally reachable. In the router mode, the ISP <b>24</b> assigns the ATU-R <b>12</b> a global IP address and the ATU-R <b>12</b> performs NAT for private addresses that it, in turn, assigns to the client <b>10</b>.

p-0044In the bridge mode, policy routing occurs in the PC and a mapping occurs in the ATU-R. That is, the PC decides whether to send traffic over the PPP session or directly to the ATU-R over Ethernet. The packet received at the ATU-R, however, requires an additional mapping step. Once the traffic is received at the ATU-R, the ATU-R determines which PVC to send the traffic over. One PVC is assigned to the PPP session, and other PVCs can match different SVCs in the ATM network. The additional mapping step is enabled by a mapping table in the ATU-R that shows which PVCs are currently attached to SVCs. Although all packet travels through the ATU-R, some packets are encapsulated in a PPP session, whereas other packets are raw IP packets transported via the Ethernet connection.

p-0045Regardless of whether the bridge mode or the routed mode is in use, header patterns are always sent to the ATU-R. The header patterns that are sent are the same header patterns that the PC uses to determine whether to encapsulate the packet. That is, the PC decides whether to use PPP or not, and the ATU-R decides which PVC to use. Once an SVC is set up, both tables are updated.

p-0046In the router mode, all policy routing occurs in the ATU-R, therefore only one table exists. Accordingly, no dynamic changes occur in the PC and packets are not encapsulated in PPP by the PC. When appropriate, the ATU-R encapsulates the packets in PPP.

p-0047The connection server <b>25</b> terminates customer control channel sessions, which transit the public IP network. The control channel session is used by the customers to send CONNECT and DISCONNECT requests to the connection server <b>25</b>. The connection server <b>25</b>, in return, reports connection status information to the customers using the control channel session. In an embodiment of the present invention, this control channel session employs authentication and encryption.

p-0048The connection server <b>25</b> maintains two levels of sessions: (1) a per user session anchored on the control channel connection; and (2) a per SVC session anchored on individual SVC connections set up by the service. When a user logs in, the user establishes a user session that is associated with the user ID. Once the user establishes an SVC, an SVC session is created. If the user establishes another SVC, another SVC session is created. Thus, each user session may be associated with multiple SVC sessions.

p-0049The connection server <b>25</b> performs the CAC function for the user ATU-R and DSLAM ports and is able to manage the complex topology of any DSLAM <b>14</b>. This is necessary because the pre-provisioned PVCs in the ATU-R <b>12</b> and DSLAM <b>14</b> will require over subscription of the priority bandwidth on the DSLAM up-link ports. Over subscription occurs when a group of PVCs, with aggregate bandwidth exceeding the actual available bandwidth, are created. It is assumed that, statistically, only a fraction of the PVCs are active simultaneously and that the bandwidth used by the active fraction does not exceed the actual available bandwidth. It is advantageous to service providers to over subscribe network resources to take advantage of this statistical multiplexing effect. For example, a DSLAM up-link may have enough bandwidth to handle ten simultaneous QoS connections. The service provider may choose to provision twenty QoS PVCs on that up-link if it is expected that typically only ten or fewer of the QoS PVCs are in use at one time. In this scenario, the connection server CAC function would prevent the eleventh QoS PVC from becoming active should the actual usage exceed the expected usage. Only as many pre-provisioned QoS PVCs may be active as there is bandwidth available thus ensuring the QoS of the active connections.

p-0050The connection server <b>25</b> can be any server class system, such as a UNIX workstation. The connection server <b>25</b> tracks the PVCs' status in real time, monitoring whether the PVCs are in use or available. If multiple applications share a PVC, the connections server <b>25</b> monitors how much available bandwidth is allocated to each application. When enough bandwidth is not available for a connection request, the connection server <b>25</b> denies service requests. The connection server <b>25</b> handles association of PVCs and SVCs, and also reserves space on PVCs.

p-0051In one embodiment, each DSLAM actually includes a master DSLAM and at least one slave DSLAM. In this embodiment, the connections server <b>25</b> is aware of the DSLAM topology, e.g., the total bandwidth available on a DSLAM trunk port. The topology information is useful so that the connection server <b>25</b> is aware of which PVCs are used to connect from the trunk port of the master DSLAM to the appropriate subscriber port. The connections server <b>25</b> ensures that enough bandwidth exists for a connection request, and if so, grants the bandwidth to the user.

p-0052A logical view of the system is now described with reference to <figref idrefs="DRAWINGS">FIG. 2</figref>. A subscriber SVC-enabled application <b>100</b>, running on the client PC, negotiates with a peer to establish agreed upon parameters for a direct SVC connection. This negotiation occurs using the best effort PPPoE channel, i.e., the control channel. Both SVC-enabled end points must agree upon a required class of service, a required bandwidth or bit rate, and a shared secret or session key that uniquely identifies the proposed session between these two end points. The mechanism of this negotiation is independent of the SVC service. For example, the negotiation could be an Instant Messaging server facilitated negotiation or a voice telephone call between users.

p-0053The subscriber SVC-enabled application <b>100</b> at each end-point sends a request to establish a SVC connection to its respective network service agent <b>102</b>, which resides in the subscriber's computer <b>10</b> or the ATU-R <b>12</b>. The request includes the source username, destination username, class of service, bandwidth, shared session key, and IP routing/mapping information.

p-0054The network service agent <b>102</b> can be located on either the client PC <b>10</b> or the ATU-R <b>12</b>. In the bridge mode, the network service agent <b>102</b> resides on the subscriber's system <b>10</b> and in the router mode it resides on the subscriber's ATU-R <b>12</b>. The network service agent <b>102</b> handles network layer connection duties, including managing an API interface between the ATU-R <b>12</b> and the subscriber <b>10</b>. The network service agent <b>102</b> also manages the routing tables as well as session establishment and termination. In addition, the network service agent <b>102</b> executes packet filtering rules.

p-0055In one embodiment, the network service agent <b>102</b> includes two input APIs: (1) an HTTP or command line API, e.g., a Telnet based configuration suitable for direct human interaction, and (2) a socket based API for process to process communications. Users or applications, which are clients of the network service agent <b>102</b>, can send CONNECT, DISCONNECT, STATUS, and REACHABILITY requests to the connection server <b>104</b> via the network service agent <b>102</b> and the secure connection between the network service agent <b>102</b> and the connection server <b>104</b>. Return information from client requests should be explicitly output to the user in the case of the human readable interface. For the process to process API, return information can be returned via the socket connection between the client process <b>100</b> and network service agent <b>102</b>. In addition, the client process <b>100</b> should be able to poll status information via the network service agent <b>102</b> to self determine the result of requests.

p-0056Because the network service agent <b>102</b> changes the routing and mapping tables, the layer 3 and layer 4 information associated with the SVC flow must be communicated by the application or user to the network service agent <b>102</b> as part of the CONNECT request. Only the information relevant to layer 2 provisioning is passed on to the connection server <b>104</b> for the SVC portion of the connection establishment.

p-0057Output APIs are also provided in the network service agent <b>102</b>. In the bridge mode, the network service agent <b>102</b> (residing in the client <b>10</b>) manipulates the static policy routing tables in the client <b>10</b> and the mapping filter function in the ATU-R <b>12</b>. In the router mode, the network service agent <b>102</b> (residing in the ATU-R <b>12</b>) manipulates the policy routing tables and mapping filter function of the ATU-R <b>12</b>. As noted above, in the router mode the client <b>10</b> uses the ATU-R <b>12</b> as the default layer 3 gateway and does not require additional configuration.

p-0058The network service agent <b>102</b> is responsible for establishing a secure connection to the connection server <b>104</b>, providing authentication information to the connection server <b>104</b>, and authenticating the identity of the connection server <b>104</b>. The network service agent <b>102</b> is also responsible for handling client requests by working with the connection server <b>104</b>, over the network service agent <b>102</b>/connection server <b>104</b> secure channel, to establish and tear down SVC connections and to poll current status information. In response to SVC status changes resulting from configuration requests or network events, the network service agent <b>102</b> re-configures routing and mapping tables in the client <b>10</b> and/or ATU-R <b>12</b> to maintain appropriate routing of client traffic.

p-0059Each network service agent (local and remote) <b>102</b> will, on-demand, establish a secure channel to the connection server <b>104</b> over the best effort PPPoE channel. The network service agent <b>102</b> also authenticates each user to determine whether the user is authorized to establish SVCs. Once authenticated, the connection server <b>104</b> authenticates the management session and responds to connection setup requests, connection tear down requests, connection status polls, and reachability inquiries.

p-0060In one embodiment, to service a connection setup request, the connection server <b>104</b> receives matching connection requests from both network service agents <b>102</b> within a time-out window. The connection requests should have matching attribute elements. To service a connection tear down request, the connection server <b>102</b> can receive a request from only one of the network service agents <b>102</b>. The connection server <b>104</b> may respond to connection status polls with status messages indicating the SVCs in use, class of service, bandwidth, session keys, etc. Optionally, the connection server <b>104</b> may also send asynchronous status updates to the network service agents <b>102</b> upon connection and/or disconnection.

p-0061In the event of connection setup or tear down, the connection server <b>104</b> communicates with the proxy signaling agent <b>106</b> to accomplish the requested provisioning task. The proxy signaling agent <b>106</b> signals the network elements to provision the SVC. Upon confirmation of successful provisioning, the SVC status is passed back to the connection server <b>104</b> and to the network service agent <b>102</b>.

p-0062After receiving verification of SVC setup, each network service agent <b>102</b> changes policy routing tables in the PC <b>10</b> or ATU-R <b>12</b>, in bridge and routing modes, respectively; changes mapping functions in the ATU-R <b>12</b>; and informs the requesting subscriber SVC-enabled application <b>100</b> that the SVC channel has been configured. The mapping functions in the ATU-R <b>12</b> include the rules that the ATU-R <b>12</b> should use for filtering each packet and directing the packet into a specific PVC that connects to the SVC. As discussed above, the mapping function is dynamically established to correspond to the SVC session duration.

p-0063Informing the application <b>100</b> that the SVC channel has been configured may be accomplished in a session established between the subscriber SVC-enabled application <b>100</b> and the network service agent <b>102</b>. Alternatively, the subscriber SVC-enabled application <b>100</b> may simply poll the network service agent <b>102</b> for connection status to self determine success or failure.

p-0064Once the SVC has been established and appropriate routing changes have been made, packets matching the policy routing and/or mapping rules will be transmitted over the SVC channel as long as the SVC is active.

p-0065The SVC may be deactivated by either: (1) the subscriber SVC-enabled application <b>100</b> sending a disconnect request to the connection server <b>104</b> via its network service agent <b>102</b>, (2) termination of the connection server <b>104</b> to network service agent <b>102</b> management channel (either explicit or time-out), or (3) a network event such as re-routing or other failure. When a network event occurs, the SVC status is known by the proxy signaling agent <b>106</b> and communicated to the connection server <b>104</b>. Moreover, the connection server <b>104</b> informs both sides that the SVC has been cleared. In the event of a disconnect request or termination of the management channel, the connection server <b>104</b> informs the non-disconnected side that the SVC has been cleared.

p-0066Upon notification of SVC tear down via either an update message or status polling, the network service agent <b>102</b> modifies the policy routing and mapping tables in the client device <b>10</b> and/or ATU-R <b>12</b> to reflect the change in connectivity.

p-0067Communications between the network service agent <b>102</b> and the connection server <b>104</b> are now discussed in more detail.

p-0068A CONNECT request should include the following parameters: source subscriber, destination subscriber, class of service, bandwidth, and session key. In order to process the CONNECT request, matching CONNECT requests should be received from both the source subscriber and the destination subscriber within a time-out period. The connection server <b>104</b> processes validated CONNECT requests by querying the LDAP <b>30</b> to determine required provisioning information, such as ATM AESA addresses, available PVC identifiers at each end-point, etc. The connection server <b>104</b> also selects suitable PVC identifiers, class of service, and traffic descriptors, and performs CAC functions for ATU-R and DSLAM ports based on real time SVC tracking information and port speeds obtained from the LDAP <b>30</b>. Finally, the connection server <b>104</b> services validated CONNECT requests by passing provisioning information to the proxy signaling agent <b>106</b>.

p-0069Upon being notified by the proxy signaling agent <b>106</b> of successful provisioning or failure to provision, the connection server <b>104</b> updates its internal real time SVC session tracking information. The provisioning result may be communicated to the calling network service agents <b>102</b> by an explicit response to the CONNECT request and/or waiting for the network service agent <b>102</b> to inquire about the current SVC status information (polling).

p-0070A DISCONNECT request should include the following parameters: source subscriber, destination subscriber, class of service, bandwidth, and session key. A DISCONNECT request is determined to be valid when it is received from one or both network service agents <b>102</b> and it matches an existing, previously established SVC connection. The connection server <b>104</b> services valid DISCONNECT requests by matching the DISCONNECT request with its real time SVC tracking table, and communicating stored information to the proxy signaling agent <b>106</b> to clear the SVC.

p-0071Upon provisioning success or failure, communicated by the proxy signaling agent <b>106</b>, the connection server <b>104</b> updates its internal real time SVC session tracking information. The provisioning result may be communicated to the calling network service agent <b>102</b> by an explicit response to the DISCONNECT request and/or waiting for the network service agent <b>102</b> to inquire about the current SVC status information (polling).

p-0072A STATUS request requires no parameters. The connection server <b>104</b> simply updates the requesting network service agent <b>102</b> with the status of all SVCs terminated by the ATU-R <b>12</b> managed by the network service agent <b>102</b>.

p-0073A REACHABILITY request requires a destination subscriber parameter. In response to a REACHABILITY request, the connection server <b>104</b> informs the querying network service agent <b>102</b> of whether the destination subscriber is reachable, via SVC, from the source subscriber <b>10</b>. The response to the request only confirms that source to destination connectivity is possible, and it does not take into account available bandwidth, etc.

p-0074Each network service agent <b>102</b> connects to the connection server <b>104</b> to initiate SVC connections. This network service agent <b>102</b> to connection server <b>104</b> connection is made over the public Internet, and it must be authenticated and secure.

p-0075If the network service agent <b>102</b> to connection server <b>104</b> connection is dropped or times out, any SVCs established by the network service agent's username is automatically released by the connection server <b>104</b>. In the case of multiple network service agent <b>102</b> to connection server <b>104</b> connections using the same username (PC client based network service agent <b>102</b>), all SVCs established under the username must be released automatically once the final network service agent <b>102</b> to connection server <b>104</b> connection is dropped or times out. Time outs may be determined using an explicit keep-alive mechanism if this is not provided by the secure encryption layer.

p-0076An advantage of the proxy signaling approach described above is that such an approach does not require SVC capability for ATU-Rs or for DSLAMs. If the ATU-R does have SVC capability, another approach may be employed. Such an approach will be referred to as Extended Virtual UNI.

p-0077Thus, according to the present invention a subscriber can dynamically connect to a selected peer via a combination of a SVC PVCs. Once the SVC is established, the packets are policy routed. Consequently, quality of service can be guaranteed for specific end user applications.

p-0078Although the invention has been described with reference to several exemplary embodiments, it is understood that the words that have been used are words of description and illustration, rather than words of limitation. Changes may be made within the purview of the appended claims, as presently stated and as amended, without departing from the scope and spirit of the invention in its aspects. Although the invention has been described with reference to particular means, materials and embodiments, the invention is not intended to be limited to the particulars disclosed; rather, the invention extends to all functionally equivalent structures, methods, and uses such as are within the scope of the appended claims. For example, although the description has been directed towards setting up a QoS connection to a peer subscriber, the connection(s) could also be set up to one or more application service providers (ASPs).

p-0079In accordance with various embodiments of the present invention, the methods described herein are intended for operation as software programs running on a computer processor. Dedicated hardware implementations including, but not limited to, application specific integrated circuits, programmable logic arrays and other hardware devices can likewise be constructed to implement the methods described herein. Furthermore, alternative software implementations including, but not limited to, distributed processing or component/object distributed processing, parallel processing, or virtual machine processing can also be constructed to implement the methods described herein.

p-0080It should also be noted that the software implementations of the present invention as described herein are optionally stored on a tangible storage medium, such as: a magnetic medium, e.g., a disk or tape; a magneto-optical or optical medium such as a disk; or a solid state medium such as a memory card or other package that houses one or more read-only (non-volatile) memories, random access memories, or other re-writable (volatile) memories. A digital file attachment to email or other self contained information archive or set of archives is considered a distribution medium equivalent to a tangible storage medium. Accordingly, the invention is considered to include a tangible storage medium or distribution medium, as listed herein and including art-recognized equivalents and successor media, in which the software implementations herein are stored.

p-0081Although the present specification describes components and functions implemented in the embodiments with reference to particular standards and protocols, the invention is not limited to such standards and protocols. Each of the standards for signaling and packet-switched network transmission and public telephone networks (e.g., ATM and DSL) represent examples of the state of the art. Such standards are periodically superseded by faster or more efficient equivalents having essentially the same functions. Accordingly, replacement standards and protocols having the same functions are considered equivalents.